Bug 92308 - Crash on emailing document
Summary: Crash on emailing document
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
5.0.0.1 rc
Hardware: Other All
: highest critical
Assignee: Björn Michaelsen
URL:
Whiteboard: target:5.1.0 target:5.0.0.3
Keywords: bibisected, bisected, haveBacktrace, regression
: 92337 92537 92601 92635 (view as bug list)
Depends on:
Blocks:
 
Reported: 2015-06-24 14:04 UTC by Yousuf Philips (jay) (retired)
Modified: 2016-09-10 21:33 UTC (History)
12 users (show)

See Also:
Crash report or crash signature:


Attachments
linux backtrace (29.57 KB, text/plain)
2015-06-24 14:04 UTC, Yousuf Philips (jay) (retired)
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Yousuf Philips (jay) (retired) 2015-06-24 14:04:20 UTC
Created attachment 116799 [details]
linux backtrace

Steps:
1) Open Writer
2) File > Send > Email Document
3) Crash

Version: 5.1.0.0.alpha1+
Build ID: 3ecef8cedb215e49237a11607197edc91639bfcd
TinderBox: Linux-rpm_deb-x86_64@46-TDF, Branch:master, Time: 2015-06-20_01:01:56
Comment 1 raal 2015-06-24 14:28:25 UTC
Reproducible with Version: 5.1.0.0.alpha1+
Build ID: a64999511ae654131d997eec9a3d78478cfc1c75
TinderBox: Linux-rpm_deb-x86_64@46-TDF, Branch:master, Time: 2015-06-22_05:01:17

 /opt/libreofficedev5.1/program/soffice
Picked up JAVA_TOOL_OPTIONS: -javaagent:/usr/share/java/jayatanaag.jar 
#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0x00007f2eeef4f0a2, pid=23638, tid=139840669452864
#
# JRE version: Java(TM) SE Runtime Environment (8.0_45-b14) (build 1.8.0_45-b14)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (25.45-b02 mixed mode linux-amd64 compressed oops)
# Problematic frame:
# C  [libswlo.so+0x3b10a2]  SwDoc::HasInvisibleContent() const+0x252
#
# Failed to write core dump. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
#
# An error report file with more information is saved as:
# /home/user/hs_err_pid23638.log
#
# If you would like to submit a bug report, please visit:
#   http://bugreport.java.com/bugreport/crash.jsp
Comment 2 Jacques Guilleron 2015-06-24 14:46:48 UTC
Hi Jay,

I reproduce with 
5.1.0.0.alpha1+ Build ID: 437210d58f32177ef1829d704f7f4d2f1bbfbfdd
TinderBox: Win-x86@39, Branch:master, Time: 2015-06-18_07:21:56
and Windows 7 Home Premium
Also with all LO 5 versions:
LO 5.0.0.1 Build ID: 9a0b23dd0ab9652e0965484934309f2d49a7758e
LO 5.0.0.0.beta3 Build ID: 96345c15d8ab19c49014f055fe41ba8e1f421e5c
LO 5.0.0.0.beta1 Build ID: 0a16c3dda4150008d9be6f24cbd15ac198d116d3
LO 5.0.0.0.alpha1+ Build ID: 6664859e1e8b3f8b7db8c931b8d0335510c20ce0
TinderBox: Win-x86@42, Branch:master, Time: 2015-05-16_03:16:31
Works into LO 4.4.4.2

Jacques
Comment 3 Dave Richards 2015-06-24 15:04:30 UTC
Crashing in 5.0 daily build, so moving version back to that version.  Trying to run a bibisect against 50max.
Comment 4 Dave Richards 2015-06-24 15:14:06 UTC
Here is the bibisect results, clearly fails in the area of this commit


0d72ed4f5bfc65a7938e017f56993ef2f58ecfae is the first bad commit
commit 0d72ed4f5bfc65a7938e017f56993ef2f58ecfae
Author: Matthew Francis <mjay.francis@gmail.com>
Date:   Wed May 27 20:07:10 2015 +0800

    source-hash-0d97d25d56a5a8466d698e0f5831f2072c8e8baf
    
    commit 0d97d25d56a5a8466d698e0f5831f2072c8e8baf
    Author:     Bjoern Michaelsen <bjoern.michaelsen@canonical.com>
    AuthorDate: Sat Mar 14 18:34:28 2015 +0100
    Commit:     Bjoern Michaelsen <bjoern.michaelsen@canonical.com>
    CommitDate: Mon Mar 16 13:24:07 2015 +0100
    
        use SwIterator for typed iteration
    
        Change-Id: Icc1a04304e182687a306e9d08cbf7d46b0adbee6

:040000 040000 0b748f313010b12aba22716dcacba79734f711de e7c8094d348227c370deaeb2b754b5e145ab8b88 M	opt
Comment 5 Michael Meeks 2015-06-24 15:36:15 UTC
Interesting.

(gdb) 
#4  0x00007fffac60102e in SwDoc::HasInvisibleContent (this=0x114f070) at /data/opt/libreoffice/master/sw/source/core/doc/doc.cxx:1456
1456	        SwSectionFormat* pSectFormat = rSectFormats[ n ];
(gdb) l
1451	    }
1452	
1453	    const SwSectionFormats& rSectFormats = GetSections();
1454	    for( SwSectionFormats::size_type n = rSectFormats.size()-1; n; --n )
1455	    {
1456	        SwSectionFormat* pSectFormat = rSectFormats[ n ];
1457	        // don't add sections in Undo/Redo
1458	        if( !pSectFormat->IsInNodesArr())
1459	            continue;
1460	        SwSection* pSect = pSectFormat->GetSection();

(gdb) p rSectFormats
$1 = (const SwSectionFormats &) @0x10bfb10: {<SwFormatsModifyBase<SwSectionFormat*>> = {<SwVectorModifyBase<SwSectionFormat*>> = {<std::__debug::vector<SwSectionFormat*, std::allocator<SwSectionFormat*> >> = std::__debug::vector of length 0, capacity 0, _vptr.SwVectorModifyBase = 0x7fffadebd470 <vtable for SwSectionFormats+16>, mPolicy = SwVectorModifyBase<SwSectionFormat*>::FreeElements}, <SwFormatsBase> = {_vptr.SwFormatsBase = 0x7fffadebd4a0 <vtable for SwSectionFormats+64>}, <No data fields>}, <No data fields>}

We're referencing at index -1 ;-)

Bjoern looks strongly like:

commit 0d97d25d56a5a8466d698e0f5831f2072c8e8baf
Author: Bjoern Michaelsen <bjoern.michaelsen@canonical.com>
Date:   Sat Mar 14 18:34:28 2015 +0100

    use SwIterator for typed iteration

-        for( SwSectionFmts::size_type n = rSectFmts.size(); !bRet && (n > 0); )
+    for( SwSectionFmts::size_type n = rSectFmts.size()-1; n; --n )
Comment 6 Marek Dolezel 2015-06-26 13:16:57 UTC
*** Bug 92337 has been marked as a duplicate of this bug. ***
Comment 7 ribotb 2015-06-29 12:11:45 UTC
Always crash in RC2 on Win7 x86 :
Version: 5.0.0.2
Build ID: a26d58f11b99b6aeddf7f7884effea188cc6e512
Locale : fr-FR (fr_FR)

Bernard
Comment 8 Commit Notification 2015-07-03 20:18:55 UTC
Bjoern Michaelsen committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=6cadfe0f07659235c6438c345d501eca89b411d5

tdf#92308: Dont crash on "File > Send > Email Document"

It will be available in 5.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 9 Björn Michaelsen 2015-07-03 20:22:07 UTC
Waiting for 5.0 review at:
https://gerrit.libreoffice.org/#/c/16749/
Comment 10 Commit Notification 2015-07-03 20:59:57 UTC
Bjoern Michaelsen committed a patch related to this issue.
It has been pushed to "libreoffice-5-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=d78b81b379333bd471c670bc9f49304f1d6f030a&h=libreoffice-5-0

tdf#92308: Dont crash on "File > Send > Email Document"

It will be available in 5.0.0.3.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 11 Björn Michaelsen 2015-07-03 21:30:53 UTC
Sorry for the delay on the trivial fix, I must have overlooked comment 4/5 when they initially flew by. => RESOLVED/FIXED now.
Comment 12 Björn Michaelsen 2015-07-04 11:07:25 UTC
*** Bug 92537 has been marked as a duplicate of this bug. ***
Comment 13 raal 2015-07-05 05:11:22 UTC
verified in Version: 5.1.0.0.alpha1+
Build ID: 3c45bfb0cabf206f6217f1de9eb5cfa12b78e46f
TinderBox: Linux-rpm_deb-x86_64@46-TDF, Branch:master, Time: 2015-07-04_01:25:39
Thanks for the fix.
Comment 14 Jacques Guilleron 2015-07-12 09:56:10 UTC
*** Bug 92635 has been marked as a duplicate of this bug. ***
Comment 15 Robinson Tryon (qubit) 2015-12-17 09:14:49 UTC Comment hidden (obsolete)
Comment 16 peterpan 2016-09-10 21:33:31 UTC
*** Bug 92601 has been marked as a duplicate of this bug. ***